Question

For my assingment I’m supposed to create a file of precomputed hash values from a given dictionary with a salt of 0 – 255 to each password. I have the hashes, but when I try to compare them with the given shadow file, I get nothing. This leads me to believe I’m perhaps hashing incorrectly? My professor did say that the password hashes were done with C. Does that make a difference?

Here is my code:
find the hashes

import hashlib

f = open('/root/dictionary/dictionary', 'r')
print f
i=0
def getMD5Hash(textToHash=None):
return hashlib.md5(textToHash).hexdigest()

for line in f:
    line = line.rstrip()
    #print line
    i=0

    while i <= 255:
            j=str(i)
            line1 = j+line
            md5=getMD5Hash(line1)
            print md5,':',line1
            i+=1

cracking

f1 = open('/root/dictionary/shadow3','r')


def crack(Hash=None):
    f = open('/root/dictionary/HASHES','r')

    for line in f:
    line = line.rstrip()
    line1 = line.split(" ")[0]

    if line == Hash:
        print (line,"\n",Hash)
        return line




for line in f1:
    line = line.rstrip()
    line = line.split(":")[1:]
    print line[0]
    result = crack(line[0])
    print result

EDIT: Rar file with the shadows I was given: http://mediafire.com/?euwjpxr3np36brt

dictionary file given – http://mediafire.com/?psspoqo900x0hmq

Answer 1

EDIT:

Got it, I think. Look at your crack() function. You open the hash file and then for line in f you strip the line and then split the line into line1 to get the hash out of your hash file. You then compare the full line instead of line1 to the hash that you want to crack. Of course, the full line contains more than just the hash so it can’t match. For clarity sake, you could rename line1 to generated_hash. Then, it would be more obvious that you need if generated_hash == Hash:

Other Notes:

Through some troubleshooting, we’ve determined that the example hashes posted in the question were invalid. I also established that the method used in the solution for the seed is indeed `hashlib.md5(salt+cleartext).hexdigest(). The poster is correctly generating the hashes, but is failing at some point when trying to compare them to the shadow files they were given. Initially, there were some problems with line endings.

Since I know the poster is able to generate the hashes without trouble, I’m posting an alternate way to generate the hashes and store them in a dictionary so the hash table doesn’t have to be read from disk each time.

import hashlib

#Initialize an empty dictionary.  We'll add entries to this as we read the 
#dictionary file in
hash_table = {}

print('Generating hashes...')

#Using with on the file object means that it will be closed automatically
#when the block is finished
with open('dictionary.txt', 'r') as inp_file:

    for word in inp_file.readlines():

        #strip off the trailing whitespace ('\n' or '\n\r' depending on the platform)
        word = word.strip()

        #The requirement is for a salt to be prepended to the cleartext
        #dictionary word.  For each possible salt value...
        for salt in range(0,256):
            #convert the salt from an int to a string here so we don't have to
            #continually do it below
            salt = str(salt)

            #Store the hash/cleartext pair in the dictionary.  The key of the
            #dictionary is the hash and the value is the salted cleartext
            hash_table[hashlib.md5(salt+word).hexdigest()] = salt+word

Note how I’m using with fileobject as some_name: which will close the file automatically when the with block finishes. Hashes are stored in hash_table which is a key/value dictionary. We’re using the hash as the key and the cleartext as the value to make matching the hashes fast. If you want to know if a particular hash is in the hash_table, if 'some_hex_hash' in hash_table: do stuff is the right approach. To get the cleartext for a hash value, it’s simply hash_table['some_hex_hash']. See http://docs.python.org/tutorial/datastructures.html#dictionaries for more info on dictionaries.

Of course, this is the portion that you already have working. The trick now is to get the shadow hashes loaded up correctly and then check to see if they are in your file (or in the hash_table if using a dictionary).